Docker Networking
Bridged containers
桥接式容器一般拥有两个接口：一个环回借口和一个连接至主机上某桥设备的以太网接口
docker daemon启动时默认会创建一个名为docker0的网络桥，并且创建的容器桥接屎容器，其以太网口桥接至docker0
--net bridge即为将容器借口添加至docker0桥
docker0桥为NAT桥，因此，桥接式容器可通过此桥借口访问外部网络，但防火墙规则则阻止了一些从外部网络访问桥接式容器的请求
~]# docker run --rm --net bridge busybox:latest ifconfig -a
Closed containers
不参与网络通信，运行于此类容器中的进程仅能访问本地环回接口
仅适用于进程无须网络通信的场景中，例如备份、进程诊断及各种离线任务等
~]# docker run --rm --net none busybox:latest ifconfig -a
Bridged containers
可以为docker run命令使用
"--hostname HOSTNAME"选项为容器指定主机名，例如
~]# docker run --rm --net bridge --hostname bbox.smoke.com busybox:latest nslookup bbox.smoke.com
"--dns DNS_SERVER_IP"选项能够为容器指定所使用的dns服务器地址，例如
~]# docker run --rm --dns 172.16.0.1 busybox:latest nslookup docker.com
"--add-host HOSTNAME:IP"选项能够为容器指定本地主机名解析项，例如
~]# docker run --rm --dns 172.16.0.1 --add-host "docker.com:172.16.0.100" busybox:latest nslookup docker.com
Opening inboud communication
Docker0为NAT桥，因此容器一般获得的是私有网络地址
可以把容器形象为宿主机NAT服务背后的主机
如果开房容器或其上的服务为外部网络访问，需要在宿主机上为其定义DNAT规则，例如
对宿主机某IP地址的访问全映射给某容器地址
主机IP 容器IP
-A PREROUTING -d 主机IP -j DNAT --to-destination 容器IP
对宿主机某IP地址的某端口的访问映射给某容器地址的某端口
主机IP:PORT 容器IP:PORT
-A PREROUTING -d 主机IP -p {tcp|udp} --dport 主机端口 -j DNAT --to-destination 容器IP:容器端口
为docker run命令使用-p选项即可实现端口映射，无须手动添加规则
Opening inbound communication
-p选项的使用格式
-p <containerPort>
将指定的容器端口映射至主机所有地址的一个动态端口
-p <hostPort>:<containerPort>
将容器端口<containerPort>映射至指定的主机端口<hostPort>
-p <ip>::<containerPort>
将指定的容器端口<containerPort>映射至主机指定<ip>的动态端口
-p<ip>:<hostPort>:<containerPort>
将指定的容器端口<containerPort>映射至主机指定<ip>的端口<hostPort>
"动态端口"指随机端口，具体的映射结果可使用docker port命令查看
Opening inbound communication
"-P"选项或"--publish-all"将容器的所有计划要暴露端口全部映射至主机端口
计划要暴露的端口使用--expose选项指定
例如
~]# docker run -d -P --expose 2222 --expose 3333 --name web busybox:latest /bin/httpd -p 2222 -f
查看映射结果
~]# docker port web
如果不想使用默认的docker0桥接口，或者需要修改此接口的网络属性，可通过为docker daemon命令使用-b、--bip、--fixed-cidr、--default-gateway、--dns以及--mtu等选项进行设定
Joined containers
联盟式容器是指使用某个已存在容器的网络接口的容器，接口被联盟内的各容器共享使用；因此，联盟式容器彼此间完全无隔离，例如
创建一个监听于2222端口的http服务容器
~]# docker run -d -it --rm -p 2222 busybox:latest /bin/httpd -p 2222 -f
创建一个联盟式容器，并查看其监听的端口
~]# docker run -it --rm --net container:web --name joined busybox:latest netstat -tan
联盟式容器彼此间虽然共享同一个网络名称空间，但其它名称空间如User、Mount等还是隔离的
联盟式容器彼此间存在端口冲突的可能性，因此，通常只会在多个容器上的程序需要程序loopback接口互相通信、或对某已存的容器的网络属性进行监控时才使用此种模式的网络模型
Docker参考手册：
https://docs.docker.com/engine/reference/commandline/dockerd/
配置docker守护进程的属性信息的方法：/etc/docker/daemon.json
每一个可设置的键是dockerd的可用的选项，其值为选项的参数；但有些参数不可用于此文件中，例如add-registry,insecure-registry；
有些选项的参数是数组的格式，需要放置于[]；
官方手册（完整的可用参数列表）：
https://docs.docker.com/engine/reference/commandline/dockerd/#run-multiple-daemons
{
"authorization-plugins": []
"data-root": "",
"dns": [],
"dns-opts": [],
"dns-search": [],
"exec-opts": [],
"exec-root": "",
"experimental": false,
"storage-driver": "",
"storage-opts": [],
"labels": [],
"live-restore": true,
"log-driver": "",
"log-opts": {},
"mtu": 0,
"pidfile": "",
"cluster-store": "",
"cluster-store-opts": {},
"cluster-advertise": "",
"max-concurrent-downloads": 3,
"max-concurrent-uploads": 5,
"default-shm-size": "64M",
"shutdown-timeout": 15,
"debug": true,
"hosts": [],
"log-level": "",
"tls": true,
"tlsverify": true,
"tlscacert": "",
"tlscert": "",
"tlskey": "",
"swarm-default-advertise-addr": "",
"api-cors-header": "",
"selinux-enabled": false,
"userns-remap": "",
"group": "",
"cgroup-parent": "",
"default-ulimits": {},
"init": false,
"init-path": "/usr/libexec/docker-init",
"ipv6": false,
"iptables": false,
"ip-forward": false,
"ip-masq": false,
"userland-proxy": false,
"userland-proxy-path": "/usr/libexec/docker-proxy",
"ip": "0.0.0.0",
"bridge": "",
"bip": "",
"fixed-cidr": "",
"fixed-cidr-v6": "",
"default-gateway": "",
"default-gateway-v6": "",
"icc": false,
"raw-logs": false,
"allow-nondistributable-artifacts": [],
"registry-mirrors": [],
"seccomp-profile": "",
"insecure-registries": [],
"disable-legacy-registry": false,
"no-new-privileges": false,
"default-runtime": "runc",
"oom-score-adjust": -500,
"runtimes": {
"runc": {
"path": "runc"
},
"custom": {
"path": "/usr/local/bin/my-runc-replacement",
"runtimeArgs": [
"--debug"
]
}
}
}
dockerd守护进程的C/S，其默认仅监听Unix SOcket格式的地址，/var/run/docker.sock；如果使用TCP套接字，
/etc/docker/daemon.json：
"hosts": ["tcp://0.0.0.0:2375", "unix:///var/run/docker.sock"]
也可向dockerd直接传递“-H|--host”选项；
自定义docker0桥的网络属性信息：/etc/docker/daemon.json文件
{
"bip": "192.168.1.5/24",
"fixed-cidr": "10.20.0.0/16",
"fixed-cidr-v6": "2001:db8::/64",
"mtu": 1500,
"default-gateway": "10.20.1.1",
"default-gateway-v6": "2001:db8:abcd::89",
"dns": ["10.20.1.2","10.20.1.3"]
}
核心选项为bip，即bridge ip之意，用于指定docker0桥自身的IP地址；其它选项可通过此地址计算得出。
文档路径：
https://docs.docker.com/engine/userguide/networking/default_network/custom-docker0/
容器构建示例：
https://github.com/mysql/mysql-docker
node3:
[root@node3 ~]# ip netns add r1
[root@node3 ~]# ip netns add r2
[root@node3 ~]# ip netns list
r2
r1
[root@node3 ~]# ip netns exec r1 ip addr show
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
[root@node3 ~]# ip netns exec r2 ip addr show
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
[root@node3 ~]# ip link add name veth1.1 type veth peer name veth1.2
[root@node3 ~]# ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether 00:0c:29:03:53:27 brd ff:ff:ff:ff:ff:ff
3: ens37: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether 00:0c:29:03:53:31 brd ff:ff:ff:ff:ff:ff
4: veth1.2@veth1.1: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether 2a:72:97:50:d8:5a brd ff:ff:ff:ff:ff:ff
5: veth1.1@veth1.2: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether a6:1a:e3:74:5c:45 brd ff:ff:ff:ff:ff:ff
[root@node3 ~]# ip link set dev veth1.2 netns r1
[root@node3 ~]# ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether 00:0c:29:03:53:27 brd ff:ff:ff:ff:ff:ff
3: ens37: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether 00:0c:29:03:53:31 brd ff:ff:ff:ff:ff:ff
5: veth1.1@if4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether a6:1a:e3:74:5c:45 brd ff:ff:ff:ff:ff:ff link-netnsid 0
[root@node3 ~]# ip netns exec r1 ip addr show
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
4: veth1.2@if5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 2a:72:97:50:d8:5a brd ff:ff:ff:ff:ff:ff link-netnsid 0
[root@node3 ~]# ip netns exec r1 ip link set dev veth1.2 name eth0
[root@node3 ~]# ip netns exec r1 ip addr show
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
4: eth0@if5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 2a:72:97:50:d8:5a brd ff:ff:ff:ff:ff:ff link-netnsid 0
[root@node3 ~]# ip add add 10.1.0.1/24 dev veth1.1
[root@node3 ~]# ip link set veth1.1 up
[root@node3 ~]# ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:03:53:27 brd ff:ff:ff:ff:ff:ff
inet 172.16.100.69/16 brd 172.16.255.255 scope global noprefixroute ens33
valid_lft forever preferred_lft forever
inet6 fe80::270d:efa4:1975:8122/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: ens37: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:03:53:31 brd ff:ff:ff:ff:ff:ff
inet 192.168.204.144/24 brd 192.168.204.255 scope global noprefixroute dynamic ens37
valid_lft 1359sec preferred_lft 1359sec
inet6 fe80::fd72:802f:c7bf:f34e/64 scope link noprefixroute
valid_lft forever preferred_lft forever
5: veth1.1@if4: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state LOWERLAYERDOWN group default qlen 1000
link/ether a6:1a:e3:74:5c:45 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 10.1.0.1/24 scope global veth1.1
valid_lft forever preferred_lft forever
[root@node3 ~]# ip netns exec r1 ip add add 10.1.0.2/24 dev eth0
[root@node3 ~]# ip netns exec r1 ip link set eth0 up
[root@node3 ~]# ip netns exec r1 ip addr show
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
4: eth0@if5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 2a:72:97:50:d8:5a brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 10.1.0.2/24 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::2872:97ff:fe50:d85a/64 scope link
valid_lft forever preferred_lft forever
[root@node3 ~]# ping 10.1.0.2
PING 10.1.0.2 (10.1.0.2) 56(84) bytes of data.
64 bytes from 10.1.0.2: icmp_seq=1 ttl=64 time=0.103 ms
64 bytes from 10.1.0.2: icmp_seq=2 ttl=64 time=0.070 ms
--- 10.1.0.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.070/0.086/0.103/0.018 ms
[root@node3 ~]# ip link set dev veth1.1 netns r2
[root@node3 ~]# ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:03:53:27 brd ff:ff:ff:ff:ff:ff
inet 172.16.100.69/16 brd 172.16.255.255 scope global noprefixroute ens33
valid_lft forever preferred_lft forever
inet6 fe80::270d:efa4:1975:8122/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: ens37: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:03:53:31 brd ff:ff:ff:ff:ff:ff
inet 192.168.204.144/24 brd 192.168.204.255 scope global noprefixroute dynamic ens37
valid_lft 1084sec preferred_lft 1084sec
inet6 fe80::fd72:802f:c7bf:f34e/64 scope link noprefixroute
valid_lft forever preferred_lft forever
[root@node3 ~]# ip netns exec r2 ip addr show
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
5: veth1.1@if4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether a6:1a:e3:74:5c:45 brd ff:ff:ff:ff:ff:ff link-netnsid 0
[root@node3 ~]# ip netns exec r2 ip add add 10.1.0.3/24 dev veth1.1
[root@node3 ~]# ip netns exec r2 ip link set veth1.1 up
[root@node3 ~]# ip netns exec r2 ping 10.1.0.2
PING 10.1.0.2 (10.1.0.2) 56(84) bytes of data.
64 bytes from 10.1.0.2: icmp_seq=1 ttl=64 time=0.065 ms
64 bytes from 10.1.0.2: icmp_seq=2 ttl=64 time=0.080 ms
--- 10.1.0.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1006ms
rtt min/avg/max/mdev = 0.065/0.072/0.080/0.011 ms
node2:
[root@node2 ~]# docker run --name t1 -it --rm busybox:latest
/ # ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
5: eth0@if6: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
valid_lft forever preferred_lft forever
/ # exit
[root@node2 ~]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
[root@node2 ~]# docker run --name t1 -it --network bridge --rm busybox:latest
/ # ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
7: eth0@if8: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
valid_lft forever preferred_lft forever
/ # exit
[root@node2 ~]# docker run --name t1 -it --network none --rm busybox:latest
/ # ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
/ # exit
[root@node2 ~]# docker run --name t1 -it --network bridge --rm busybox:latest
/ # hostname
6fc8ef5f5f9f
[root@node2 ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
6fc8ef5f5f9f busybox:latest "sh" 2 minutes ago Up 2 minutes t1
[root@node2 ~]# docker run --name t1 -it --network bridge -h t1.smoke.com --rm busybox:latest
/ # hostname
t1.smoke.com
/ # cat /etc/hosts
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.17.0.2 t1.smoke.com t1
/ # cat /etc/resolv.conf
# Generated by NetworkManager
search localdomain
nameserver 192.168.204.2
/ # nslookup -type=A www.baidu.com
Server: 192.168.204.2
Address: 192.168.204.2:53
Non-authoritative answer:
www.baidu.com canonical name = www.a.shifen.com
Name: www.a.shifen.com
Address: 14.215.177.38
Name: www.a.shifen.com
Address: 14.215.177.39
/ # exit
[root@node2 ~]# docker run --name t1 -it --network bridge -h t1.smoke.com --dns 114.114.114.114 --rm busybox:latest
/ # cat /etc/resolv.conf
search localdomain
nameserver 114.114.114.114
/ # exit
[root@node2 ~]# docker run --name t1 -it --network bridge -h t1.smoke.com --dns 114.114.114.114 --dns-search ilinux.io --rm busybox:latest
/ # cat /etc/resolv.conf
search ilinux.io
nameserver 114.114.114.114
/ # exit
[root@node2 ~]# docker run --name t1 -it --network bridge -h t1.smoke.com --dns 114.114.114.114 --dns-search ilinux.io --add-host www.smoke.
com:1.1.1.1 --rm busybox:latest
/ # cat /etc/hosts
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
1.1.1.1 www.smoke.com
172.17.0.2 t1.smoke.com t1
/ # exit
容器端口映射
node2:
[root@node2 ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
smoke584520/httpd v0.2 8128e6c4341f 3 days ago 1.22MB
smoke584520/httpd v0.1-1 80bef960860d 3 days ago 1.22MB
busybox latest 83aa35aa1c79 2 weeks ago 1.22MB
[root@node2 ~]# docker run --name myweb --rm -p 80 smoke584520/httpd:v0.2
[root@node2 ~]# docker inspect myweb
"Networks": {
"bridge": {
"IPAMConfig": null,
"Links": null,
"Aliases": null,
"NetworkID": "3fcfdc8c16d1ad1c37173c8d6f9afb75f4ab940a5547cbc2ae342107befcf489",
"EndpointID": "42d24e7d8cdc2a83551d431635f24269f432221f55295a6270002c2005b7c46b",
"Gateway": "172.17.0.1",
"IPAddress": "172.17.0.2",
"IPPrefixLen": 16,
"IPv6Gateway": "",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"MacAddress": "02:42:ac:11:00:02",
"DriverOpts": null
}
}
[root@node2 ~]# curl 172.17.0.2
<h1>Busybox httpd server.</h1>
[root@node2 ~]# iptables -t nat -vnL DOCKER
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all -- docker0 * 0.0.0.0/0 0.0.0.0/0
0 0 DNAT tcp -- !docker0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:32768 to:172.17.0.2:80
通过windows主机访问172.16.100.68:32768
[root@node2 ~]# docker kill myweb
[root@node2 ~]# iptables -t nat -vnL DOCKER
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all -- docker0 * 0.0.0.0/0 0.0.0.0/0
[root@node2 ~]# docker run --name myweb --rm -p 80 smoke584520/httpd:v0.2
[root@node2 ~]# docker port myweb
80/tcp -> 0.0.0.0:32769
[root@node2 ~]# docker kill myweb
[root@node2 ~]# docker run --name myweb --rm -p 172.16.100.68::80 smoke584520/httpd:v0.2
[root@node2 ~]# docker port myweb
80/tcp -> 172.16.100.68:32768
通过windows主机访问172.16.100.68:32768
[root@node2 ~]# docker kill myweb [root@node2 ~]# docker run --name myweb --rm -p 80:80 smoke584520/httpd:v0.2 [root@node2 ~]# docker port myweb 80/tcp -> 0.0.0.0:80
通过windows主机访问172.16.100.68
[root@node2 ~]# docker kill myweb [root@node2 ~]# docker run --name myweb --rm -p 172.16.100.68:8080:80 smoke584520/httpd:v0.2 [root@node2 ~]# docker port myweb 80/tcp -> 172.16.100.68:8080
通过windows主机访问172.16.100.68:8080
联盟式容器
[root@node2 ~]# docker kill myweb
[root@node2 ~]# docker run --name b1 -it --rm busybox
/ # ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
33: eth0@if34: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
valid_lft forever preferred_lft forever
[root@node2 ~]# docker run --name b2 -it --rm busybox
/ # ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
35: eth0@if36: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0
valid_lft forever preferred_lft forever
/ # exit
[root@node2 ~]# docker run --name b2 --network container:b1 -it --rm busybox
/ # ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
33: eth0@if34: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
valid_lft forever preferred_lft forever
/ # mkdir /tmp/testdir #b1容器
/ # ls /tmp/
testdir
/ # ls /tmp/ #b2容器
/ # echo "hello world" > /tmp/index.html
/ # httpd -h /tmp/
/ # netstat -tnl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 :::80 :::* LISTEN
/ # wget -O - -q 127.0.0.1 #b1容器
hello world
/ # exit
/ # exit #b2容器
容器共享宿主机名称空间
[root@node2 ~]# docker run --name b2 --network host -it --rm busybox
/ # ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:0c:29:70:86:6c brd ff:ff:ff:ff:ff:ff
inet 172.16.100.68/24 brd 172.16.100.255 scope global ens33
valid_lft forever preferred_lft forever
inet6 fe80::d665:1c67:c985:a1cf/64 scope link
valid_lft forever preferred_lft forever
3: ens37: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:0c:29:70:86:76 brd ff:ff:ff:ff:ff:ff
inet 192.168.204.143/24 brd 192.168.204.255 scope global dynamic ens37
valid_lft 1263sec preferred_lft 1263sec
inet6 fe80::d698:df07:91e4:43a6/64 scope link
valid_lft forever preferred_lft forever
4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue
link/ether 02:42:9f:bc:17:16 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:9fff:febc:1716/64 scope link
valid_lft forever preferred_lft forever
/ # echo "hello container" > /tmp/index.html
/ # httpd -h /tmp/
/ # netstat -tnl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 192.168.204.143:10010 0.0.0.0:* LISTEN
tcp 0 0 :::80 :::* LISTEN
tcp 0 0 :::22 :::* LISTEN
tcp 0 0 ::1:25 :::* LISTEN
通过windows主机访问172.16.100.68
更改docker0桥网络
/ # exit
[root@node2 ~]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
[root@node2 ~]# systemctl stop docker
[root@node2 ~]# vim /etc/docker/daemon.json
{
"registry-mirrors": ["https://bhzjdbej.mirror.aliyuncs.com"],
"bip": "10.0.0.1/16"
}
[root@node2 ~]# systemctl start docker
[root@node2 ~]# ip addr show docker0
4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:9f:bc:17:16 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.1/16 brd 10.0.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:9fff:febc:1716/64 scope link
valid_lft forever preferred_lft forever
修改docker进程使用TCP套接字
[root@node2 ~]# ll /var/run/docker.sock
srw-rw----. 1 root docker 0 Mar 31 14:58 /var/run/docker.sock
[root@node2 ~]# systemctl stop docker
[root@node2 ~]# vim /etc/docker/daemon.json
{
"registry-mirrors": ["https://bhzjdbej.mirror.aliyuncs.com"],
"bip": "10.0.0.1/16",
"hosts": ["tcp://0.0.0.0:2375", "unix:///var/run/docker.sock"]
}
[root@node2 ~]# systemctl start docker
[root@node2 ~]# ss -tnl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:22 *:*
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 128 192.168.204.143:10010 *:*
LISTEN 0 128 :::2375 :::*
LISTEN 0 128 :::22 :::*
LISTEN 0 100 ::1:25 :::*
[root@node2 ~]# ls /var/run/docker.sock
/var/run/docker.sock
node1:
[root@node1 ~]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES b7dd3077e6fd smoke584520/httpd:v0.2 "/bin/httpd -f -h /d…" 3 days ago Up 3 days t2 56fa207d1c0a busybox "sh" 4 days ago Up 4 days b1 e163c9c2aa7e redis:4-alpine "docker-entrypoint.s…" 5 days ago Up 5 days 6379/tcp kvstor1 728e6866b8bb nginx:1.14-alpine "nginx -g 'daemon of…" 5 days ago Up 5 days 80/tcp web1 [root@node1 ~]# docker -H 172.16.100.68:2375 ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES [root@node1 ~]# docker -H 172.16.100.68:2375 image ls REPOSITORY TAG IMAGE ID CREATED SIZE smoke584520/httpd v0.2 8128e6c4341f 3 days ago 1.22MB smoke584520/httpd v0.1-1 80bef960860d 4 days ago 1.22MB busybox latest 83aa35aa1c79 3 weeks ago 1.22MB
创建自定义桥
node2:
[root@node2 ~]# docker network ls
NETWORK ID NAME DRIVER SCOPE
4adb4b1e005d bridge bridge local
d8476f993d9b host host local
1f1795697fce none null local
[root@node2 ~]# docker info
Network: bridge host macvlan null overlay
[root@node2 ~]# docker network create -d bridge --subnet "172.26.0.0/16" --gateway "172.26.0.1" mybr0
[root@node2 ~]# docker network ls
NETWORK ID NAME DRIVER SCOPE
4adb4b1e005d bridge bridge local
d8476f993d9b host host local
c4b35ed70a6c mybr0 bridge local
1f1795697fce none null local
[root@node2 ~]# ip addr show br-c4b35ed70a6c
37: br-c4b35ed70a6c: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:f7:22:71:42 brd ff:ff:ff:ff:ff:ff
inet 172.26.0.1/16 brd 172.26.255.255 scope global br-c4b35ed70a6c
valid_lft forever preferred_lft forever
[root@node2 ~]# docker run --name t1 -it --net mybr0 busybox:latest
/ # ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
38: eth0@if39: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
link/ether 02:42:ac:1a:00:02 brd ff:ff:ff:ff:ff:ff
inet 172.26.0.2/16 brd 172.26.255.255 scope global eth0
valid_lft forever preferred_lft forever
[root@node2 ~]# docker run --name t2 -it --net bridge busybox:latest
/ # ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
40: eth0@if41: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
link/ether 02:42:0a:00:00:02 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.2/16 brd 10.0.255.255 scope global eth0
valid_lft forever preferred_lft forever
[root@node2 ~]# cat /proc/sys/net/ipv4/ip_forward
1
[root@node2 ~]# watch -d -n 1 "iptables -L DOCKER-ISOLATION-STAGE-2 -n -v --line-number"
Chain DOCKER-ISOLATION-STAGE-2 (2 references)
num pkts bytes target prot opt in out source destination
1 0 0 DROP all -- * br-c4b35ed70a6c 0.0.0.0/0 0.0.0.0/0
2 362 30408 DROP all -- * docker0 0.0.0.0/0 0.0.0.0/0
3 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
[root@node2 ~]# iptables -I DOCKER-ISOLATION-STAGE-2 1 -j ACCEPT
/ # ping 10.0.0.2 #t1容器pingt2容器
PING 10.0.0.2 (10.0.0.2): 56 data bytes
64 bytes from 10.0.0.2: seq=0 ttl=63 time=0.261 ms
64 bytes from 10.0.0.2: seq=1 ttl=63 time=0.202 ms
64 bytes from 10.0.0.2: seq=2 ttl=63 time=0.157 ms
^C
--- 10.0.0.2 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.157/0.206/0.261 ms
浙公网安备 33010602011771号